The majority of those users are in the US, where the Trump-affiliated, data-analysis firm Cambridge Analytica has been accused of tapping profiles without users' permission in order to influence elections, including during the 2016 presidential campaign.

Facebook said it did not know precisely what information was shared with Cambridge Analytica, but pledged to restrict access from apps to personal profiles and to notify users who may have been affected.

"All organisations that are covered by the Privacy Act have obligations in relation to the personal information that they hold," Ms Falk said.

"This includes taking reasonable steps to ensure that personal information is held securely, and ensuring that customers are adequately notified about the collection and handling of their personal information."

The Acting Commissioner argued the incident should serve as a warning to protect private data.

The Federal Government declined to comment on the investigation, saying it would await the commissioner's findings.